RFID tag dump PWA + REST API (with Docker Compose) (#2)

* Implement RFID tag dump PWA with REST API, auth, and CI

Add Next.js app with SQLite/Drizzle storage for sites and LF/HF tag
dumps, multi-user Auth.js (credentials + optional OIDC), personal API
tokens in Settings, versioned /api/v1 for UI and future CLI use,
MCT/Proxmark/JSON import-export, PWA offline shell, Vitest tests, and
GitHub Actions CI.

* Add Docker Compose setup with persistent volume

Improve the production Dockerfile (healthcheck, entrypoint bootstrap
user, pruned deps) and add docker-compose.yml plus .dockerignore for
one-command deploy with a named SQLite volume.

---------

Co-authored-by: Cursor Agent <[email protected]>

README.md

@@ -86,16 +86,57 @@ GitHub Actions runs lint, typecheck, and tests on every pull request and push to
 
 ## Docker
 
+<<<<<<< HEAD
+### docker compose (recommended)
+
+```bash
+cp .env.example .env
+# set AUTH_SECRET to a long random string
+
+# optional first user on boot:
+# echo '[email protected]' >> .env
+# echo 'CREATE_USER_PASSWORD=changeme' >> .env
+
+docker compose up -d --build
+```
+
+App: http://localhost:3000 — SQLite persists in the `rfid-data` volume.
+
+Create a user later (if you skipped bootstrap):
+
+```bash
+docker compose exec rfid-database \
+  npx tsx scripts/create-user.ts --email [email protected] --password 'secret' --name You
+```
+
+Stop / remove (keeps volume):
+
+```bash
+docker compose down
+```
+
+### Plain docker
+
+=======
+>>>>>>> origin/main
 ```bash
 docker build -t rfid-database .
 docker run --rm -p 3000:3000 \
   -e AUTH_SECRET=your-long-secret \
+<<<<<<< HEAD
+  -e CREATE_USER_EMAIL=[email protected] \
+  -e CREATE_USER_PASSWORD=changeme \
+=======
+>>>>>>> origin/main
   -v rfid-data:/data \
   rfid-database
 ```
 
+<<<<<<< HEAD
+=======
 Create the first user against the mounted DB (exec into the container or run `create-user` with `RFID_DB_PATH` pointed at the volume).
 
+>>>>>>> origin/main
 ## Security
 
 Tag dumps often include sector keys. Keep the app behind HTTPS, do not expose it publicly without auth, and treat `data/rfid.db` as sensitive.